What Canadian Securities Regulators Expect on a Token or DAO Website

By Cody Wise, founder of Wise Media, Calgary. Last updated 6 November 2026. General information about Canadian securities regulation, not legal advice. Token offerings are high risk legally. Retain Canadian securities counsel before you publish anything.

Summary

• There is no CSA token website disclosure standard. The honest framing is that nothing is prescribed and everything you publish is evidence.
• CSA Staff Notice 46-308 treats website and whitepaper statements as indicia of whether a token is a security. Scarcity copy, team credentials, roadmaps and listing teasers all count against you.
• Ontario’s Securities Act prohibits undertakings about future value or price and representations that a security will be listed. BC requires written permission for listing representations, subject to a general permission.
• In the NetCents settlement, a whitepaper hosted on the company’s own site was itself the admitted misrepresentation, and liability ran until takedown.
• A “not available to Canadian residents” banner is evidence of intent, not a legal conclusion, and marketing in Canada while Canadians cannot use the product actively suggests the token is a security.

Table Of Contents

• The Honest Starting Point: Nothing Is Prescribed
• The Test Your Website Is Evidence For
• What Your Pages Admit, Section By Section
• The Hard Prohibitions
• Two Canadian Cases Where The Website Was The Problem
• The Canadian Exclusion Banner
• What To Actually Do
• Common Mistakes
• FAQ

The Honest Starting Point: Nothing Is Prescribed

Founders often ask what a token website is required to disclose in Canada. There is no such list. No CSA notice prescribes the contents of a project website.

What exists instead is two things, and understanding the difference saves a lot of wasted effort.

• A hard requirement that if you are distributing a security, investors get a prescribed disclosure document. CSA Staff Notice 46-307 puts it directly: “Although whitepapers are a form of disclosure document for investors they are often not structured in the same way as prospectuses or OMs”, and “Investors must be provided with a document that complies with the requirements of securities laws.” The quality standard it sets is worth memorising: disclosure “must focus on material facts and be relevant, clear, balanced, in plain language and not overly promotional.”
• Misrepresentation liability that attaches to whatever you publish, whether or not you had a disclosure obligation at all.

So a whitepaper is not a prospectus, and publishing one does not discharge anything. Everything else you read about “what regulators expect on a token site” is staff expectation rather than requirement, and most of it is addressed to reporting issuers or to trading platforms rather than to you. That gap between nothing prescribed and everything admissible is what makes a crypto and Web3 site a legal document as much as a marketing one.

The 50 Word Version

Canada prescribes no token website disclosures. Instead, your site’s copy is evidence in the test of whether your token is a security, and statutory bans on future price undertakings and listing representations apply directly to it. Write for utility, avoid investment framing, and get Canadian securities counsel first.

The Test Your Website Is Evidence For

Two CSA staff notices govern whether a token is a security in Canada, and both remain current: Staff Notice 46-307 Cryptocurrency Offerings, dated 24 August 2017, and Staff Notice 46-308 Securities Law Implications for Offerings of Tokens, dated 11 June 2018. Later crypto notices address trading platforms and funds rather than token issuance, so nothing has displaced these two on the classification question. The OSC’s crypto businesses resource page still lists both as live reference material.

46-307 sets out what it calls the four-prong test, citing the Supreme Court’s decision in Pacific Coast Coin Exchange v. Ontario (Securities Commission) in a footnote. An investment contract exists where there is:

1. “An investment of money”
2. “In a common enterprise”
3. “With the expectation of profit”
4. “To come significantly from the efforts of others”

The notice adds the two sentences that matter most: the analysis “requires an assessment of the economic realities of a transaction and a purposive interpretation”, and “In assessing whether or not securities laws apply, we will consider substance over form.” It specifically anticipates the obvious workaround: “Although a new technology is involved, and what is being sold is referred to as a coin/token instead of a share.”

Note for accuracy: 46-307 does not itself use the label “Pacific Coast test”. That is conventional shorthand. The Capital Markets Tribunal applied the same four elements to a crypto business in Manticore Labs OÜ (Re), 2024 ONCMT 19, which is the most recent authoritative Canadian application.

Here is why this matters for a website. 46-308 states that staff consider “representations made by the issuer either formally in a whitepaper or informally through social media channels (e.g., messaging platforms, community meetups, online videos)”, and “representations made by third parties that have been explicitly or implicitly endorsed by the issuer or management.” It also notes staff “may also ask for copies of promotional materials in connection with the offering.”

Your marketing is not adjacent to the legal question. It is the input to it.

What Your Pages Admit, Section By Section

46-308 lists situations that indicate an offering involves securities. Mapped onto the pages of a typical project site, they read like a site audit.

The mitigation 46-308 offers is the most useful sentence in the notice for anyone writing copy: “to the extent that management clearly and uniformly promotes the token in a manner that, taken as a whole, promotes only its utility and not its investment value, the implication that purchasers have an expectation of profit may be reduced.”

Read “clearly and uniformly” and “taken as a whole” carefully. One stray line on a landing page, one Telegram message from a founder, one ambassador’s tweet you did not correct, undoes a disciplined whitepaper. Consistency across every surface is the standard, not consistency in the formal document.

One important limit, in the notice’s own words: “none of these examples should be interpreted as determinative on its own”, and “The fact that a token has a utility is not, on its own, determinative.” This is a weighing exercise, not a checklist you can pass.

The Hard Prohibitions

Staff notices are guidance. Provincial securities acts are law, and three categories of statement are prohibited outright.

Undertakings About Future Value Or Price

Ontario’s Securities Act section 38 is headed “Representations prohibited”, and subsection 38(2) deals with undertakings as to future value or price. Ontario enforcement documents describe the breach in those terms: a Capital Markets Tribunal statement of allegations records that respondents “gave undertakings as to the future value or price of the securities of Shallow Oil contrary to section 38(2) of the Act”.

Pull section 38 verbatim from Ontario’s e-Laws before quoting it, since the consolidated text is what governs and the wording above is drawn from enforcement documents rather than from the statute itself.

Representations About Future Listings

This is the one crypto sites breach most casually, usually with a “coming soon to major exchanges” line or a row of exchange logos.

In Ontario, section 38(3) covers representations that a security will be listed. In British Columbia, the position is set out in BC Notice 47-701, which describes the prohibition on a person “while engaging in investor relations activities” representing that a security will be listed or quoted, or that an application has been made, “without obtaining the prior written permission of the Executive Director.” A variation order effective 27 March 2020 renumbered the provision to section 50(1)(d), removed the “intention of effecting a trade” element because it “is no longer an element of the prohibition on making representations about listing”, and provides a general permission that “does not require a person to seek written permission in individual cases.”

Two cautions. BCSC currently files 47-701 under historical instruments, which likely reflects the superseded pre-amendment version rather than withdrawal of the permission, so confirm the live status with BCSC before relying on it. And the general permission does not licence a false listing claim; the misrepresentation provisions still apply.

Misleading Or Untrue Statements

Ontario’s section 126.2 and British Columbia’s misrepresentation provision attach to anything you publish. This is the catch-all and it is how most crypto website cases are actually charged.

Two Things People Claim That Are Not True

Worth saying plainly, because both circulate widely.

No CSA notice prohibits the word “guaranteed”. There is no Canadian staff notice containing an express ban on “guaranteed returns” or “guaranteed yield”. The hook for such a claim is the general false or misleading standard, the misrepresentation provisions, and the statutory ban on undertakings as to future value. Do not avoid the word and assume you are compliant; avoid the substance.

There is no Canadian guidance on staking yield advertising for token projects. The nearest material, CSA Staff Notice 81-336 and the 2025 amendments to NI 81-102, governs public investment funds rather than token issuers. Anyone citing those to you as rules for your staking page is overreaching. The gap means you are back to the general standards, not that the area is unregulated.

Two Canadian Cases Where The Website Was The Problem

NetCents Technology Inc., BCSC, 2025

Settlement agreement 2025 BCSECCOM 139 and order 2025 BCSECCOM 140, published 23 April 2025. This is the clearest Canadian example of website content being the admitted misconduct.

The agreed facts name the media specifically. A whitepaper hosted on the company’s own website, live from 10 October 2017 until at least 19 December 2017, claimed the company was working with an independent non-profit organisation. A separate website purporting to be that organisation’s own site ran from 6 November 2017 until at least 22 March 2018. News releases in November 2017 stated tranches of the coin had sold out. A YouTube video, live from January 2017 until at least September 2019, stated a monthly revenue figure.

The contraventions included illegal distribution and misrepresentations the company “knew, or ought reasonably to have known, were false”. The outcome was $3.3 million payable to the BCSC.

Two lessons that generalise. First, a satellite “foundation” site is not a shield; if the entity it describes is not what the site says it is, the site is the misrepresentation. Second, look at those durations. Liability ran from publication until takedown. A claim left live for two years because nobody owned the site is the exposure, not the moment it was written.

The Axia Project, OSC, 2024

Settlement agreement approved by the Capital Markets Tribunal on 26 January 2024, File No. 2024-1. The agreed facts record that the project maintained several websites, that each “was freely accessible to any user of the internet”, and that promotion happened “including by posting them to the Axia Websites”, across blog posts, news releases and at least nineteen versions of whitepapers.

The objectionable claims are a catalogue of crypto marketing conventions: statements about billions in audited tangible assets, the coin described as a “safe haven” with an “unmatched” value proposition, as the future “preferred global medium of exchange” and “new reserve currency for the world”, as the first “hyper-deflationary” digital currency, and representations that the coin would be listed or relisted on exchanges.

Admitted breaches included making statements the respondents knew or ought to have known were misleading in a material respect, unregistered trading, and distributing without a prospectus. The tokens were admitted to be securities.

If your homepage currently describes your token as a safe haven, a reserve currency, or hyper-deflationary, that paragraph has been litigated.

The Canadian Exclusion Banner

The common founder assumption is that a “not available to Canadian residents” line solves the problem. The primary source cuts the other way.

46-308 lists as an indicium that a token is a security the situation where “Marketing of the offering targets persons or companies who would not reasonably be expected to use the issuer’s product, service or application.” Its worked example: an offering “is marketed in Canada, but Canadian residents cannot use the product, service or application”, which “could indicate that purchasers are primarily motivated by the potential for profit, not the ability to use the product.”

Read that twice. Marketing into Canada while Canadians cannot use the thing makes the securities characterisation more likely, not less. A geoblock on utility combined with open marketing is the fact pattern the notice is describing.

Two further points. 46-308 reminds businesses “to consider securities law requirements that may apply to their activities, regardless of where investors are located”, and CSA staff have stated in the platform context that they “may take enforcement action against CTPs, including foreign-based CTPs that have investors in Canada”. Offshore incorporation plus a Canadian-facing site is not a shield.

What the notice does offer as mitigation is know your client: “Performing know your client on purchasers may help issuers to establish the general profile of their purchasers, potentially enabling the issuer to demonstrate a purchaser’s intended use of the token.” Note the hedging. It may help. No Canadian regulator has published a safe harbour standard for an exclusion disclaimer, and a banner with no actual exclusion controls behind it is evidence of intent rather than a defence.

What To Actually Do

1. Get Canadian securities counsel before you publish. Not after launch. 46-308 itself encourages businesses “to consult qualified securities legal counsel in their local jurisdiction” and to contact their local regulator, noting that applications to the CSA Regulatory Sandbox “are analyzed on a case-by-case basis.”
2. Audit every surface, not just the whitepaper. Site, docs, blog, Telegram, Discord, X, YouTube, ambassador posts. The uniformity standard applies across all of them and third-party statements you endorse count.
3. Remove price and listing language entirely. No forecasts, no comparisons to tokens that appreciated, no exchange logos, no “coming soon to” anything. These are the statutory prohibitions, not matters of tone.
4. Write the utility pages as product documentation. What it does, how to use it, what exists today. If the product does not exist yet, saying so plainly is better than a roadmap written as an investment thesis.
5. Reconsider the gamification. Countdown timers, early-bird tiers, referral leaderboards and bonus schemes all encourage acting quickly “for fear of missing out”, which CSA and IIROC staff flagged as a concern in the platform context. That notice binds platforms rather than token issuers, and it is the clearest published window into how staff read this kind of copy.
6. Make every entity on the site real. If a foundation is named, it must exist and be what you say it is. That was the admitted misrepresentation in NetCents.
7. Give the site an owner and a takedown process. Liability runs until removal. Stale claims are the recurring pattern in both cases above.
8. Keep records that substantiate every factual claim. If you cannot evidence it, do not publish it.

For the broader marketing picture beyond the site itself, see crypto marketing compliance in Canada. On the trust and presentation side, which matters because credibility and compliance pull in the same direction here, our Web3 branding and trust guide covers how to look substantial without making claims you cannot defend.

Common Mistakes

• Treating the whitepaper as the compliance artefact. Every surface counts, and the standard is uniformity across all of them.
• Exchange logos or “listing soon” on the homepage. A statutory prohibition, not a style choice.
• A tokenomics page built around scarcity. Hard caps and burns are explicitly listed as indicating an expectation of profit.
• A credentialed team page framed around value creation. It evidences common enterprise and reliance on others.
• Assuming a geoblock banner solves it. Marketing into Canada while Canadians cannot use the product points the other way.
• Letting ambassadors make price claims. Statements by promoters you incentivise are attributed to the offering.
• Leaving old claims live. Liability ran for two years in NetCents on content nobody removed.
• Relying on disclaimers. CSA and IIROC staff have said plainly that “Disclaimers and assumptions cannot be used to justify a statement that is false or misleading.”

FAQ

Is My Token A Security In Canada?

It depends on the four-prong investment contract test applied to the economic reality of your offering, with substance over form. CSA staff have said most token offerings they reviewed involved securities. Only Canadian securities counsel can answer it for your project, and the answer turns partly on what your website says.

What Must A Token Website Disclose In Canada?

Nothing is prescribed. There is no CSA token website disclosure standard. If you are distributing a security you must deliver a disclosure document in the required form, and separately everything you publish is subject to misrepresentation liability and the statutory prohibitions on price and listing representations.

Can I Say My Token Will Be Listed On An Exchange?

Ontario prohibits representations that a security will be listed. British Columbia requires the Executive Director’s prior written permission, subject to a general permission that removes the need to apply case by case. Confirm the current position with counsel. Beyond the prohibition, a listing teaser is also evidence of resale expectation.

Does A Utility Token Avoid Securities Law?

Not by label. CSA Staff Notice 46-308 states that “The fact that a token has a utility is not, on its own, determinative.” Genuine, available, used utility helps. A utility described in a roadmap does not.

Does Excluding Canadians Protect Me?

Not by itself. 46-308 treats marketing in Canada where Canadians cannot use the product as an indicium that the token is a security. Regulators have also indicated they may act against foreign businesses with Canadian investors. A banner with no exclusion controls behind it is not a defence.

Is A Whitepaper Enough?

No. 46-307 states investors must be provided with a document complying with securities law requirements, and that whitepapers are often not structured like prospectuses or offering memoranda. It also requires disclosure to be “relevant, clear, balanced, in plain language and not overly promotional.”

Do These Rules Apply To A DAO?

The analysis is the same, because it looks at economic reality rather than legal structure. A decentralised governance wrapper does not change whether purchasers expect profit from the efforts of others. If anything, a DAO site that emphasises a core team’s roadmap while describing the project as decentralised creates a tension a regulator will notice.

Conclusion

There is no checklist to pass. The realistic position is that Canadian regulators read your website as evidence of what you are actually selling, two provincial prohibitions apply directly to price and listing claims, and in both recent Canadian cases the site itself was the exhibit. Write every page as product documentation, keep the message uniform across every channel including other people’s, and retain counsel before you publish rather than after a letter arrives.

We build Web3 sites that look credible without making claims that create exposure, and we will tell you when a page you want needs a lawyer rather than a designer. Tell us about the project through our intake form.